Threat Actor Profiling

Threat Actor Profiling

A threat actor profile is a living document that consolidates everything known about a threat group. It grows over time as new intelligence is collected.

Profile Template

## Threat Actor Profile: [Primary Name]

### Summary
| Field | Value |
|-------|-------|
| **Primary Name** | [Most commonly used name] |
| **Aliases** | [All known aliases across vendors] |
| **Attribution** | [State sponsor / Criminal group / Hacktivist — with confidence level] |
| **Affiliation** | [Specific agency/unit if known, e.g., GRU Unit 26165] |
| **Motivation** | [Espionage / Financial / Disruption / Hacktivism / Mixed] |
| **Active Since** | [Year of first known activity] |
| **Status** | [Active / Dormant / Disbanded] |
| **Sophistication** | [Low / Medium / High / Advanced] |
| **Primary Targets** | [Sectors and geographies] |
| **Assessment Date** | [Date of this profile version] |

### Attribution Assessment
[Detailed attribution discussion with confidence level. Who attributes this group and based on what evidence? Where do vendors disagree?]

### Targeting
**Sectors**: [List targeted sectors with evidence]
**Geographies**: [Targeted countries/regions]
**Selection criteria**: [How does this group choose targets? Opportunistic vs targeted?]
**Evolution**: [How has targeting changed over time?]

### TTPs (MITRE ATT&CK)
| Tactic | Technique | ID | Notes |
|--------|-----------|-----|-------|
| Initial Access | Spearphishing Attachment | T1566.001 | Primary delivery method |
| Execution | PowerShell | T1059.001 | Used for download and execute |
| ... | ... | ... | ... |

### Tooling
| Tool | Type | Custom/Commodity | First Seen | Status | Notes |
|------|------|-----------------|-----------|--------|-------|
| [Tool 1] | Backdoor | Custom | 2024 | Active | Primary implant |
| Cobalt Strike | C2 | Commodity | 2023 | Active | Used with modified profiles |

### Infrastructure Patterns
- **Hosting preferences**: [Cloud providers, bulletproof hosting, compromised infrastructure]
- **Registrars**: [Preferred domain registrars]
- **TLS patterns**: [Self-signed? Let's Encrypt? Specific CAs?]
- **C2 protocols**: [HTTP/HTTPS, DNS, custom protocols]
- **IP ranges**: [Known IP blocks or ASNs]

### Campaign History
#### [Campaign 1] (YYYY-MM to YYYY-MM)
- **Targets**: [Who was targeted]
- **TTPs**: [Specific techniques used]
- **Outcome**: [Impact, attribution confidence]
- **References**: [Vendor reports]

### Relationships
- **Related groups**: [Parent/child groups, shared infrastructure, shared tools]
- **Overlap with**: [Groups that share TTPs or infrastructure]
- **Distinction from**: [Commonly confused groups and how to distinguish]

### Intelligence Gaps
- [What we don't know and need to collect]
- [Specific questions for future collection]

### Sources
| Date | Source | Reliability | Key Contribution |
|------|--------|-------------|-----------------|
| YYYY-MM-DD | [Source] | [Admiralty] | [What this source contributed to the profile] |

Alias Mapping

Different vendors use different names for the same group:

Always list all known aliases and cross-reference when building profiles.

Profile Maintenance

• Update when new campaigns are attributed
• Update when new tools are discovered
• Update when targeting patterns change
• Review quarterly for staleness
• Move concluded campaigns from Active to Historical
• Update intelligence gaps as gaps are filled or new ones identified

Related skills

• Vendor finished intelligence (highest leverage for state-sponsored / espionage actors) — when CrowdStrike credentials are configured, /lookup-crowdstrike actor "<name>" returns the Falcon Intel adversary profile (origins, target countries/industries, motivations, capability, aliases); /lookup-crowdstrike ttps "<name>" returns the actor's MITRE ATT&CK technique set (feed into the TTPs section); /lookup-crowdstrike reports --actor "<name>" --latest surfaces the newest finished reporting. Use these as a primary feed for the profile, then enrich. Resolve the returned technique_ids against /mitre-attack.
• Ransomware-group profiles (highest leverage for ransomware actors) — /lookup-ransomwarelive group <name> and group-profile <name> return curated TTPs, leak-site .onion infrastructure, vulnerabilities exploited, and per-group IOC + YARA dumps. Use these as the primary feed for any ransomware actor profile, then enrich.
• Community attribution — /lookup-otx pulse-search "<actor-or-alias>" for community-tagged indicators; /lookup-misp search-events --tag "actor=<name>" for prior internal cataloguing
• First-party catalog — /lookup-liberty91 library threat-actors --name "<actor>" (or --alias "<vendor-name>") resolves the actor to its canonical id; then entity threat-actors <id> for aliases, origin, target sectors and countries, --section techniques for dated ATT&CK observations (first/last observed in reporting, not a co-occurrence score), --section threat-events for the occurrences the actor has been named in, and --section related for co-occurring malware and tooling. Track the id, not the name string.
• Internal knowledge base — /lookup-opencti search "<actor-or-alias>" surfaces the intrusion sets, reports, campaigns, and malware your OpenCTI instance already links to the actor; get <id> walks the relationships. Check this before rebuilding a profile from scratch.
• Build the infrastructure cluster — /indicator-pivoting walks the IOC graph (hand off pivot_candidates from the lookups above)
• Underground-forum and Telegram footprint — /darkweb-collection for forum/channel monitoring of an actor's known aliases
• Campaigns attributed to the actor — /campaign-tracking for per-campaign records that roll up into the profile
• Knowledge cells the profile may feed into — /ransomware-ecosystem, /initial-access-brokers, /infostealers, plus any country/sector knowledge cells (e.g., /iran-cyber-espionage)
• Apply rigor — /score-source, /apply-tlp, /confidence-language, /likelihood-language, /intelligence-writing